CVE-2026-111815

Published 21 October 2026 · tracked since 22 October 2026

Description

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-114724 HIGH 7.4
• CVE-2026-114715 MEDIUM 6.8
• CVE-2026-114658 HIGH 8.8
• CVE-2026-114636 HIGH 8.7
• CVE-2026-114638 HIGH 8.7
• CVE-2026-114640 HIGH 8.7
• CVE-2026-114577 HIGH 7.3
• CVE-2026-12664 MEDIUM 6.8
• CVE-2026-15723 HIGH 8.2
• CVE-2026-110264 CRITICAL 10

→ Open the live CVE board · all tools